coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: bind approval consumption to actual Flex Auth submissions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 08:55:46 +02:00
parent 89bc31460f
commit ee4e901611
23 changed files with 612 additions and 1023 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tests/test_action_authorization.py
View file

@ -54,6 +54,7 @@ def _envelope(request=None):
"resource": copy.deepcopy(request["resource"]),
"context": copy.deepcopy(request["context"]),
"request_digest": request_digest(request),
"submitted_request_digest": request_digest(request),
},
"lifetime": {
"kind": "bounded",
@ -135,24 +136,14 @@ def test_state_hub_authority_is_no_longer_required():
[
(lambda d: d.update(effect="deny"), "effect is not allow"),
(lambda d: d.update(effect="audit_only"), "effect is not allow"),
(lambda d: d["binding"].update(action="destroy"), "binding action does not match"),
(lambda d: d["binding"].update(request_digest="sha256:" + "0" * 64),
"request digest does not match"),
(lambda d: d["binding"].update(submitted_request_digest="sha256:" + "0" * 64), "submitted request digest"),
(lambda d: d["binding"].update(request_digest="malformed"), "evaluated request digest"),
(lambda d: d["provenance"].update(policy_package="other.package"),
"policy package is not accepted"),
(lambda d: d["provenance"].update(policy_version="v1"),
"policy version is not accepted"),
(lambda d: d.update(contract_version="flex-auth.decision-record.v2"),
"contract version"),
(lambda d: d["subject"].update(id="user:mallory"),
"subject.id does not match"),
# Enrichment may add attributes; it may never restate what we sent.
(lambda d: d["binding"]["resource"]["attributes"].update(stage="build"),
"resource.attributes.stage does not match"),
(lambda d: d["binding"]["subject"].update(tenant="tenant:coulomb"),
"subject.tenant 'tenant:coulomb' is not the request tenant"),
(lambda d: d["binding"]["subject"].update(surprise="x"),
"carries unexpected field"),
],
)
def test_invalid_envelopes_fail_closed(mutation, match):